Nelson, a Florida Democrat, asked Zuckerberg why Facebook didn't inform users back in 2015, when it first discovered that data had been sold to Cambridge Analytica.
"When we heard back from Cambridge Analytica that they had told us that they weren't using the data and deleted it, we considered it a closed case," Zuckerberg said. "In retrospect, that was clearly a mistake. We shouldn't have taken their word for it."
Facebook did not inform the FTC of the improper data sharing, Zuckerberg said.
Facebook has blamed Aleksandr Kogan, the researcher who gathered user data and sold it to Cambridge Analytica, for violating Facebook's terms of service. But Richard Blumenthal, D-Conn., showed Zuckerberg the text of an agreement he said Kogan sent to Facebook when he set up his app. It claimed the right to "edit, copy, disseminate, publish, transfer, append or merge with other databases, sell, license ... and archive" data. Zuckerberg said he had not seen that text. He said that Facebook's app review team would have been responsible for that agreement and that nobody from that team has been fired over this scandal.
Zuckerberg agreed that "victims" was an appropriate word for the millions of users whose data was shared. "They did not want their information to be sold to Cambridge Analytica by a developer, and that happened, and it happened on our watch," he said. "Even though we didn't do it, I think we do have a responsibility to be able to prevent it."
But he denied that the data sharing violated Facebook's 2011 consent decree with the FTC.
Under the terms of that decree, Facebook is required to "obtain users' affirmative consent" before sharing their data. Most of the people affected by the Cambridge Analytica scandal did not opt in to Kogan's app, which collected that data; their data was scraped after a friend opted in. But Zuckerberg argued that the decree was not violated because the "Facebook Platform," which was set up to allow third-party developers to use Facebook data, allowed that practice.
"I believe that we rolled out this developer platform and that we explained to people how it worked and that they did consent to it," he said.